In this chapter, you will learn about the Splunk HTTP event collector (HEC). Metaphorically, the HEC is a catcher's mitt for Splunk to catch data sent to it via HTTP or HTTPS communication.
In this chapter, we will learn about the following topics:
The Splunk HEC is a useful and commonly used part of Splunk. The HEC does the important function of collecting and sending HTTP and HTTPS events to other systems. One common example where the HEC adds tremendous value is by capturing/sending events from/to web and mobile-based client devices. Once Splunk captures the data via the HEC from the application, it can be used for a variety of analyses related to application use and errors.
HTTP and HTTPS events can be created and delivered by web applications containing event metadata, such as time, host, and source, as well as other event data, found in the event key. The HEC makes it easy for app developers to add a minimal amount of code to their applications to send this data to Splunk. This is all done in a secure and efficient way, making it easy for application developers to be able to Splunk their application event data.
Typically, an application generates its own log file or uses Document Object Model (DOM) tagging to generate some relevant functional metrics. This is useful and still applicable to traditional multi-page web applications. However, web page development has moved forward in recent years, with a new framework called Single-Page Application (SPA). The advancement of SPA means most of an application's work in showing...
Let's begin by looking at how data flows to the HEC. This is a multi-step process that is important to understand.
Before Splunk can capture any data, it needs to be packaged from the source, which can be done in a number of different ways:
Before going further, let's review what the JSON format means. A couple of examples of key-value pairs in JSON format are shown here. The key is listed first, then a colon, and then the value of that key. Sequences of key-value pairs must...
In this chapter, you learned about the HEC and how it can be used to send data directly from an application to Splunk. To do this, you learned how to enable the HEC and create a token used as authorization to process the request. You also saw how to use cURL to submit event data. Lastly, you learned how to enrich the HEC functionality using index acknowledgement.
In the next chapter, we'll move on and learn more ways to work with Splunk as effectively as possible.
© 2018 Packt Publishing Limited All Rights Reserved
